Enhanced due diligence is one of the most operationally sensitive obligations an iGaming operator faces. Set thresholds too low and you bury your compliance team in unnecessary reviews; set them too high and you expose the business to regulatory censure. The real challenge, however, is a third dimension that compliance frameworks rarely acknowledge openly: what happens to the player while all of this is going on.
What Enhanced Due Diligence Actually Means in Practice
Standard customer due diligence covers identity verification and basic source-of-funds checks. Enhanced due diligence, commonly referred to as EDD, goes further. It applies to players who present elevated money-laundering or fraud risk, and it typically involves deeper source-of-wealth documentation, senior management sign-off, and more frequent ongoing monitoring. Regulators across Malta, Gibraltar, the Isle of Man, and the United Kingdom have all published guidance that ties EDD obligations to specific risk indicators rather than a single deposit figure.
That said, many operators still think of EDD as a threshold problem: pick a number, trigger the process above it, done. In reality, EDD is a risk-scored conversation that begins long before any single transaction and runs continuously through a player's lifecycle.
Where Thresholds Create Friction
The player-experience problem with EDD is structural. A player who deposits steadily over several months may suddenly hit an aggregated threshold that triggers a full EDD review. From the operator's perspective, this is the system working correctly. From the player's perspective, a request for bank statements, payslips, or a source-of-wealth declaration arrives with no visible context, often mid-session or shortly after a withdrawal request. The result is predictable:
- Churn: players who could have been retained abandon the review process entirely.
- Complaints: escalations to licensing bodies that damage the operator's regulatory standing.
- Reputational harm: negative reviews citing aggressive or unexplained account restrictions.
None of these outcomes serve the operator, and none of them are inevitable.
Designing Thresholds Around Risk, Not Just Volume
A more sophisticated approach separates velocity from volume. A player depositing 5,000 euros in a single session is a different risk profile from a player who reaches the same figure across twelve months of consistent recreational play. Operators who build their EDD triggers around a combination of factors, including deposit frequency, game-type behaviour, withdrawal patterns, and account tenure, can apply proportionate scrutiny without treating long-standing low-risk players like newly onboarded unknowns.
Practical calibration steps include:
- Segmenting your player base by risk tier before assigning threshold values, rather than applying a blanket monetary limit.
- Building progressive information-gathering into the onboarding journey so that source-of-funds data is collected incrementally rather than demanded all at once.
- Establishing clear internal SLAs for EDD reviews so that player accounts are not left in limbo for days while documents sit unreviewed in a queue.
- Training CRM and customer-support teams to communicate EDD requests in plain, non-accusatory language that explains the regulatory basis for the ask.
Communication Is a Compliance Tool
Operators frequently underestimate how much the framing of an EDD request affects compliance rates. A message that opens with a legal disclaimer and a list of required documents will convert far worse than one that acknowledges the player's history, explains the regulatory context briefly, and offers a clear submission pathway. This is not about softening a regulatory obligation; it is about completing it. A player who understands why they are being asked for information is substantially more likely to provide it promptly and accurately.
Compliance and retention are not opposing forces. The operators who achieve both treat EDD communication as a customer-service function, not a legal formality.
Ongoing Monitoring After EDD Clearance
EDD is not a one-time event. Regulators expect operators to revisit enhanced monitoring on a risk-proportionate schedule, meaning a player who passed EDD eighteen months ago should be reassessed if their behaviour changes materially. Automating this reassessment loop, tied to behavioural triggers rather than calendar intervals alone, reduces the manual burden on compliance teams and keeps risk profiles current without requiring blanket periodic reviews that consume resource unnecessarily.
The OnlineShine Perspective
From an operational standpoint, EDD threshold design is an area where compliance and commercial teams must work together from the outset. Thresholds built in isolation by compliance functions without commercial input tend to be overly conservative; thresholds built without compliance input create regulatory exposure. A managed-services partner with MLRO capability and CRM expertise can bridge that gap, ensuring that the policies written on paper translate into player journeys that are both compliant and commercially viable.
